@enricai/barnacle 1.12.68 → 1.12.70

package/dist/scripts/recon-generate.js

@@ -34,6 +34,7 @@ exports.selectPayloadAction = selectPayloadAction;
 exports.selectReturnAction = selectReturnAction;
 exports.selectEffectiveResponseBody = selectEffectiveResponseBody;
 exports.extractEntryUrlParams = extractEntryUrlParams;
+exports.deriveRequestHeaders = deriveRequestHeaders;
 exports.gatherResponseBodySamples = gatherResponseBodySamples;
 exports.selectPrimaryGraphQLOperation = selectPrimaryGraphQLOperation;
 exports.firstEndpointCapture = firstEndpointCapture;
@@ -49,6 +50,7 @@ exports.detectFormSchemaFieldNames = detectFormSchemaFieldNames;
 exports.indexEnumEnumNamesSchemas = indexEnumEnumNamesSchemas;
 exports.indexLabelValueOptionCodes = indexLabelValueOptionCodes;
 exports.buildSelectOptionResolutions = buildSelectOptionResolutions;
+exports.applyStructuredValuePayloadSubstitutions = applyStructuredValuePayloadSubstitutions;
 exports.walkSetCookiePairs = walkSetCookiePairs;
 exports.indexStateValues = indexStateValues;
 exports.sanitizeFixtureIdentifier = sanitizeFixtureIdentifier;
@@ -1061,6 +1063,20 @@ const IGNORE_REQUEST_HEADERS = new Set([
     ":authority",
     ":scheme",
 ]);
+/**
+ * Documented closed set of header-name fragments (matched case-insensitively,
+ * same posture as {@link VOLATILE_TIMESTAMP_KEY_FRAGMENTS}) that mark a
+ * header's VALUE as a per-session id the site mints once and resends on
+ * every request — not a stable API-contract constant. A header whose name
+ * matches must never freeze into {@link deriveRequestHeaders}' BASE_HEADERS
+ * baseline: a frozen capture value would replay one recon session's id
+ * across every real invocation, indistinguishable from a stale auth token.
+ */
+const VOLATILE_HEADER_NAME_FRAGMENTS = ["correlation-id", "conversation-id"];
+function isVolatileHeaderName(headerName) {
+    const lower = headerName.toLowerCase();
+    return VOLATILE_HEADER_NAME_FRAGMENTS.some((frag) => lower.includes(frag));
+}
 /**
  * Derives BASE_HEADERS from the request headers the browser actually sent
  * during recon, filtered to those present in every capture whose endpoint
@@ -1074,6 +1090,11 @@ const IGNORE_REQUEST_HEADERS = new Set([
  * the submission-flow detector. This catches load-bearing site-specific
  * headers (a `X-CSRF-Token`, a `Job-Boards-API-Token`, an `API-ShortName`,
  * etc.) without the generator needing to know about any particular site.
+ *
+ * A {@link isVolatileHeaderName} match is excluded even when present on
+ * every capture with an identical value — that's the signature of a
+ * per-session id the site mints once and resends, not a stable constant.
+ * `emitMultiStepExecuteHttp` re-mints it at call time instead.
  */
 function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null, ownBackendHostnames = [], fallbackDomain = null) {
     const successfulUrls = new Set(replays.filter((r) => r.success).map((r) => endpointKey(r.url)));
@@ -1107,6 +1128,8 @@ function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null,
     for (const [lower, count] of counts) {
         if (count < relevantCaptures.length)
             continue;
+        if (isVolatileHeaderName(lower))
+            continue;
         if (Object.keys(baseline).some((k) => k.toLowerCase() === lower))
             continue;
         for (const c of relevantCaptures) {
@@ -1119,8 +1142,16 @@ function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null,
     }
     return baseline;
 }
-function isGraphQL(captures) {
-    return captures.some((c) => c.operationName !== null || (0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null);
+/**
+ * Classifies the flow as GraphQL only from own-backend-host traffic, so a
+ * third-party host (chat widget, analytics SDK) making real GraphQL calls
+ * never flips a plain REST/JSON backend's classification.
+ */
+function isGraphQL(captures, ownBackendHostnames = [], fallbackDomain = null) {
+    const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
+    return captures.some((c) => (!hasHostProvenance ||
+        (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)) &&
+        (c.operationName !== null || (0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null));
 }
 /**
  * The single own-backend capture the raw GraphQL fallback (no
@@ -1202,9 +1233,12 @@ function operationGroupKey(capture) {
  * never independently resolve a different primary.
  */
 function computeEmittedPrimaryAnchor(gql, endpointPath, gqlOperationName, gqlQuery) {
-    if (!gql)
+    // Mirrors emitContractTs's own isGqlEmission gate: `gql` alone can be true
+    // with a null gqlQuery (see gqlQuery's `?? null` fallback), in which case
+    // emitContractTs falls through to REST emission — this anchor must agree.
+    if (!gql || gqlQuery === null)
         return null;
-    const name = gqlOperationName ?? (0, capture_filters_1.parsedOperationName)(gqlQuery ?? "") ?? "anonymous";
+    const name = gqlOperationName ?? (0, capture_filters_1.parsedOperationName)(gqlQuery) ?? "anonymous";
     return `${endpointPath}::${name}`;
 }
 /**
@@ -1561,8 +1595,26 @@ function resolveManifestActionSequence(runRoot, captures) {
  * Exported for tests: this predicate decides what a generated plugin will POST
  * at a live site, and it is the only gate between a browser's incidental
  * chatter and the emitted hot path.
- */
-function extractActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null) {
+ *
+ * `applyFinalAnchorNarrowing` lets a caller that will itself truncate the
+ * result via {@link truncateActionSequenceAtSubmitPattern} opt out of the
+ * final structural-relevance anchor pass, which can drop a genuine earlier
+ * chain step that shares no token with the terminal submit endpoint.
+ */
+function extractActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null, 
+// The final structural-relevance anchor pass below (guarded on
+// hasSubmitEndpointAnchor) is tuned for isolating a submission from
+// same-URL incidental chrome, not for pruning a genuine multi-step chain:
+// an earlier plain single-word step (e.g. `/lodging/hold/`) that shares no
+// compound token with the terminal submit endpoint reads as "unrelated" to
+// it and gets dropped, even though it's a real prior step whose body the
+// caller still needs. truncateActionSequenceAtSubmitPattern's own
+// index-slice already does the right, less-aggressive narrowing (keep
+// everything up to and including the last submit/fold match) — so a caller
+// that immediately truncates this result opts out with `false` to keep
+// earlier chain steps intact while still getting the structural-isolation
+// exemption above.
+applyFinalAnchorNarrowing = true) {
     const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
     // Callers with no host-provenance data (the exported function's unit
     // tests) pass neither ownBackendHostnames nor fallbackDomain — in that
@@ -1584,6 +1636,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // the submission from same-URL chrome" behavior).
     const hasSubmitEndpointAnchor = hasHostProvenance && submitPatterns !== null && submitPatterns.endpoint !== null;
     const matchesSubmit = compileSubmitMatcher(hasSubmitEndpointAnchor ? { endpoint: null, body: submitPatterns.body } : submitPatterns);
+    // Compiled once, ahead of structural isolation below, so a capture matching
+    // the flow's own declared submitEndpointPattern can be exempted there the
+    // same way a declared foldReturn endpointPattern already is — both are
+    // author-declared, both are authoritative by construction, so the isolation
+    // pass (which exists to catch INCIDENTAL same-host noise the flow never
+    // named) must not treat one differently from the other.
+    const declaredSubmitEndpointRx = submitPatterns?.endpoint != null ? new RegExp(submitPatterns.endpoint) : null;
+    const matchesDeclaredSubmitEndpoint = (capture) => declaredSubmitEndpointRx?.test(capture.url) ?? false;
     const hostGated = captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
@@ -1607,9 +1667,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // (e.g. a marketing/promotions endpoint fired incidentally by a page load,
     // admitted above because it too is a 2xx own-backend POST). Drop a
     // structurally-isolated member of the pool first — a compound-path capture
-    // (e.g. `/site-banner`) sharing no token with anything else host-gated in,
-    // regardless of whether a submitEndpointPattern is declared. Guarded to
-    // pools of 3+: a real chain's own steps are usually plain single-word
+    // (e.g. `/site-banner`) sharing no token with anything else host-gated in
+    // — unless it matches the flow's own declared submitEndpointPattern (see
+    // the exemption below): a densely-tokenized real submission path (e.g.
+    // `available-sailings`) can look exactly as isolated as incidental noise
+    // by path shape alone, and dropping it here would strip it out before the
+    // structural-relevance anchor pass further down ever gets to treat it as
+    // authoritative. Guarded to pools of 3+: a real chain's own steps are
+    // usually plain single-word
     // paths with no tokens of their own (never flagged, see
     // isStructurallyIsolatedCapture), so this only ever removes a capture that
     // is BOTH compound-path AND unrelated to every other admitted capture —
@@ -1640,11 +1705,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
                 .filter((h, j) => denselyNameSpaced ? safeUrlPathname(h.capture.url) !== path : j !== i)
                 .map((h) => safeUrlPathname(h.capture.url));
             // A capture admitted via the flow's own declared foldReturnSpec
-            // endpointPattern (the drill-down target) is authoritative by
-            // construction — the flow author named it explicitly — so it is
+            // endpointPattern (the drill-down target), or matching the flow's
+            // own declared submitEndpointPattern, is authoritative by
+            // construction — the flow author named it explicitly — so both are
             // exempt from token-overlap isolation, which exists to catch
             // INCIDENTAL same-host captures the flow never declared.
-            return matchesFoldReturn(capture) || !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths);
+            return (matchesFoldReturn(capture) ||
+                matchesDeclaredSubmitEndpoint(capture) ||
+                !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths));
         })
         : hostGated;
     // Narrow further using structural relevance, anchored on whichever
@@ -1654,15 +1722,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // authoritative reference, so this pass is a no-op — mirroring
     // compileSubmitMatcher's own null-pattern passthrough — rather than
     // guessing at a reference set.
-    if (!hasSubmitEndpointAnchor)
+    if (!hasSubmitEndpointAnchor || !applyFinalAnchorNarrowing)
         return structurallyGated;
-    const endpointRx = new RegExp(submitPatterns.endpoint);
     const referencePaths = structurallyGated
-        .filter(({ capture }) => endpointRx.test(capture.url))
+        .filter(({ capture }) => matchesDeclaredSubmitEndpoint(capture))
         .map(({ capture }) => safeUrlPathname(capture.url));
     if (referencePaths.length === 0)
         return structurallyGated;
-    return structurallyGated.filter(({ capture }) => endpointRx.test(capture.url) ||
+    return structurallyGated.filter(({ capture }) => matchesDeclaredSubmitEndpoint(capture) ||
         (0, capture_filters_1.isStructurallyRelevantCapture)(safeUrlPathname(capture.url), referencePaths));
 }
 /**
@@ -3469,25 +3536,45 @@ function locateFormEnvelopePath(parsedBody) {
  * value the request depends on, breaking the fold at exactly the case an
  * ARRAY/OBJECT-wrapped join field represents.
  *
+ * A body with no detected form envelope worth swallowing into (a facet/
+ * search body — all scalars, if any, sit directly at the root) still needs
+ * this treatment for its OWN top-level array/object fields: those are folded
+ * in as a second envelope candidate — the body root itself — deduplicated
+ * against the primary envelope's own children so a key is never visited (and
+ * never inferred/registered) twice.
+ *
  * Site-agnostic: operates only on the recon body's own shape.
- */
-function applyStructuredValuePayloadSubstitutions(template, parsedBody, outStructuredKeys, priorStepStateValues = new Set()) {
-    if (parsedBody === null || typeof parsedBody !== "object" || Array.isArray(parsedBody)) {
-        return template;
-    }
-    // Resolve the envelope object whose non-scalar children are caller structures.
-    const envelopePath = locateFormEnvelopePath(parsedBody);
-    let envelope = parsedBody;
-    for (const seg of envelopePath) {
-        if (envelope !== null && typeof envelope === "object" && !Array.isArray(envelope)) {
-            envelope = envelope[seg];
-        }
-    }
-    if (envelope === null || typeof envelope !== "object" || Array.isArray(envelope)) {
-        return template;
-    }
+ *
+ * A top-level-ARRAY-shaped body (e.g. a cruise-line multi-room search that
+ * batches per-room criteria as `[{...}, {...}]`) is walked element by
+ * element, applying this same envelope logic to each object element in
+ * textual order — otherwise a structured field living inside an array
+ * element would be invisible to this pass entirely.
+ */
+/**
+ * Applies the envelope-object substitution pass for ONE object, searching the
+ * template for each key's span starting at `searchFrom` rather than from the
+ * start of the string. This offset is what lets the caller walk a
+ * top-level-ARRAY-shaped body element by element: each array element's own
+ * key spans sit textually after the previous element's, so anchoring the
+ * search there stops an earlier element's already-rewritten (or still-frozen)
+ * span from swallowing a later element's identically-named key.
+ */
+function applyStructuredValuePayloadSubstitutionsForEnvelope(template, envelope, outStructuredKeys, priorStepStateValues, searchFrom, envelopePath, rootBody) {
     let result = template;
-    for (const [key, value] of Object.entries(envelope)) {
+    let cursor = searchFrom;
+    // The body root's own entries are eligible too, whenever the located
+    // envelope isn't the root itself — a facet/search body's top-level
+    // array/object fields (e.g. a quantity/id breakdown) are otherwise never
+    // visited at all when some deeper, primitive-richer object (e.g. a
+    // pagination/sort block) outranks the root as the "form envelope". Root
+    // keys already present on the envelope are skipped so nothing is visited
+    // (or registered) twice.
+    const envelopeEntries = Object.entries(envelope);
+    const rootEntries = envelopePath.length === 0
+        ? []
+        : Object.entries(rootBody).filter(([key]) => key !== envelopePath[0] && !(key in envelope));
+    for (const [key, value] of [...envelopeEntries, ...rootEntries]) {
         const isNonEmptyArray = Array.isArray(value) && value.length > 0;
         const isNestedObject = value !== null &&
             typeof value === "object" &&
@@ -3501,7 +3588,7 @@ function applyStructuredValuePayloadSubstitutions(template, parsedBody, outStruc
                 continue;
         }
         const keyMarker = `"${key}":`;
-        const markerIdx = result.indexOf(keyMarker);
+        const markerIdx = result.indexOf(keyMarker, searchFrom);
         if (markerIdx === -1)
             continue;
         const spanStart = markerIdx + keyMarker.length;
@@ -3540,10 +3627,55 @@ function applyStructuredValuePayloadSubstitutions(template, parsedBody, outStruc
             continue;
         const replacement = `$${"{"}JSON.stringify(payload.${key})${"}"}`;
         result = result.slice(0, spanStart) + replacement + result.slice(spanEnd);
+        cursor = Math.max(cursor, spanStart + replacement.length);
         if (!outStructuredKeys.has(key)) {
             outStructuredKeys.set(key, inferZodSchema(value));
         }
     }
+    return { result, nextSearchFrom: cursor };
+}
+/**
+ * Resolves the envelope object for a single object-shaped body (or array
+ * element) via {@link locateFormEnvelopePath} and applies the substitution
+ * pass to it. Shared by the top-level-object and top-level-array branches of
+ * {@link applyStructuredValuePayloadSubstitutions} below.
+ */
+function applyStructuredValuePayloadSubstitutionsForObjectBody(template, objectBody, outStructuredKeys, priorStepStateValues, searchFrom) {
+    const envelopePath = locateFormEnvelopePath(objectBody);
+    let envelope = objectBody;
+    for (const seg of envelopePath) {
+        if (envelope !== null && typeof envelope === "object" && !Array.isArray(envelope)) {
+            envelope = envelope[seg];
+        }
+    }
+    if (envelope === null || typeof envelope !== "object" || Array.isArray(envelope)) {
+        return { result: template, nextSearchFrom: searchFrom };
+    }
+    return applyStructuredValuePayloadSubstitutionsForEnvelope(template, envelope, outStructuredKeys, priorStepStateValues, searchFrom, envelopePath, objectBody);
+}
+function applyStructuredValuePayloadSubstitutions(template, parsedBody, outStructuredKeys, priorStepStateValues = new Set()) {
+    if (parsedBody === null || typeof parsedBody !== "object") {
+        return template;
+    }
+    // A cruise-line-style multi-room/multi-guest search body commonly batches
+    // per-element criteria as a top-level JSON ARRAY rather than a single
+    // object. Walk each element in textual order (via the growing searchFrom
+    // cursor) instead of bailing out here — otherwise any structured field
+    // living inside an array element is invisible to this pass entirely, no
+    // matter how correctly a root-level object body would have handled it.
+    if (Array.isArray(parsedBody)) {
+        let result = template;
+        let cursor = 0;
+        for (const element of parsedBody) {
+            if (element === null || typeof element !== "object" || Array.isArray(element))
+                continue;
+            const { result: nextResult, nextSearchFrom } = applyStructuredValuePayloadSubstitutionsForObjectBody(result, element, outStructuredKeys, priorStepStateValues, cursor);
+            result = nextResult;
+            cursor = nextSearchFrom;
+        }
+        return result;
+    }
+    const { result } = applyStructuredValuePayloadSubstitutionsForObjectBody(template, parsedBody, outStructuredKeys, priorStepStateValues, 0);
     return result;
 }
 /** Maximum length to guard against indexing massive blobs (HTML fragments,
@@ -5098,21 +5230,106 @@ responseBodiesForCapacitySignal = []) {
         }
     }
     let result = template;
+    const exactlyBoundKeys = new Set();
     for (const [key, value] of merged) {
         const accessor = `payload.${key}`;
         if (typeof value === "string") {
             const target = `"${key}":${JSON.stringify(value)}`;
             const replacement = `"${key}":"\${${accessor}}"`;
             result = result.split(target).join(replacement);
+            exactlyBoundKeys.add(key);
         }
         else if (typeof value === "boolean" || typeof value === "number") {
             const target = `"${key}":${JSON.stringify(value)}`;
             const replacement = `"${key}":\${${accessor}}`;
             result = result.split(target).join(replacement);
+            exactlyBoundKeys.add(key);
+        }
+    }
+    // A scalar facet field's captured value doesn't only ever surface as its
+    // OWN exact `"<field>":<value>` pair (handled above) — the same value can
+    // be packed inside an UNRELATED key's delimited facet string (e.g. a
+    // `filters`/`variables` blob shaped `ship:disney-wish|theme:merry`). This
+    // consults the SAME field↔captured-value correlation table just built
+    // (the scalar string entries of `merged`) via the identical case-
+    // insensitive splice {@link renderGqlVariablesExpr} already applies to the
+    // primary GQL operation's variables, so every body/variables template this
+    // function renders — not just that one call site — threads a facet field
+    // into `${payload.<field>}` wherever its value is actually load-bearing.
+    const scalarFieldNames = merged
+        .filter((entry) => typeof entry[1] === "string")
+        .map(([key]) => key);
+    if (scalarFieldNames.length > 0) {
+        const splicedStrings = new Set();
+        for (const body of allBodies) {
+            if (body === undefined || body === null || typeof body !== "object")
+                continue;
+            for (const { value, path } of walkAllPrimitiveLeaves(body)) {
+                if (typeof value !== "string" || value.length === 0)
+                    continue;
+                if (splicedStrings.has(value))
+                    continue;
+                // Already handled exactly above — don't double-bind the field's own
+                // top-level occurrence.
+                if (path.length === 1 && exactlyBoundKeys.has(path[0]))
+                    continue;
+                const spliced = spliceFacetsIntoStringVariable(value, scalarFieldNames);
+                if (spliced === null)
+                    continue;
+                const target = JSON.stringify(value);
+                if (!result.includes(target))
+                    continue;
+                splicedStrings.add(value);
+                result = result.split(target).join(spliced);
+            }
         }
     }
     return result;
 }
+/**
+ * REST-body counterpart to {@link renderGqlVariablesExpr}'s facet-splice
+ * branch: a top-level string leaf that packs `key:value` facet segments
+ * correlating (case-insensitively) with `payloadFieldNames` gets its
+ * correlated segments spliced with `payload.<field>` in place — via
+ * {@link spliceFacetsIntoStringVariable}, the SAME generic, site-agnostic
+ * function the GraphQL variables emitter already uses — instead of surviving
+ * as either a single opaque `payload.<key>` accessor (once
+ * {@link applyPayloadKeyValueSubstitutions} runs) or a frozen recon-time
+ * literal. Runs on the ORIGINAL captured JSON text, matching that function's
+ * own `"<key>":<JSON.stringify(value)>` target/replacement idiom, so the
+ * composite string's constituent fields — not just its own key name — become
+ * independently bindable. No-op when `payloadFieldNames` is empty (no flow
+ * steps declared any field to correlate against) or when a leaf's value has
+ * no `key:value` segment matching one of them.
+ */
+function applyFacetSplicePayloadSubstitutions(template, inputBody, payloadFieldNames, optionalFieldNames) {
+    if (payloadFieldNames.size === 0)
+        return template;
+    if (inputBody === undefined ||
+        inputBody === null ||
+        typeof inputBody !== "object" ||
+        Array.isArray(inputBody)) {
+        return template;
+    }
+    const fields = [...payloadFieldNames];
+    let result = template;
+    for (const { value, path } of walkAllPrimitiveLeaves(inputBody)) {
+        if (path.length !== 1)
+            continue;
+        const key = path[0];
+        if (!isValidJsIdentifier(key))
+            continue;
+        if (typeof value !== "string")
+            continue;
+        const spliced = spliceFacetsIntoStringVariable(value, fields, optionalFieldNames);
+        if (spliced === null)
+            continue;
+        const target = `"${key}":${JSON.stringify(value)}`;
+        const replacement = `"${key}":"\${${spliced}}"`;
+        result = result.split(target).join(replacement);
+    }
+    return result;
+}
 /**
  * Documented closed set of JSON-key-name fragments (matched case-insensitively)
  * that mark a value as a per-request TIMESTAMP the plugin must generate fresh at
@@ -5345,7 +5562,15 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
  * typecheck. `null` (the test-facing default) skips the cast, preserving
  * prior output for callers that don't exercise the full pipeline.
  */
-pascalName = null) {
+pascalName = null, 
+/** Flow steps + vocabulary the browser flow's own `payload.<field>` splices
+ * are correlated against (see {@link computeFlowPayloadFieldNames}) — threaded
+ * here so the REST body's own facet-packed string leaves (e.g. a `filters`
+ * field packing `category:widgets|priceRange:10~50`) correlate against the
+ * SAME declared field set {@link renderGqlVariablesExpr}'s GraphQL path
+ * already uses, instead of never being decomposed at all. Defaults preserve
+ * prior (no facet-splice) output for callers that don't pass a flow. */
+flowSteps = [], vocabulary = undefined) {
     // Walk the first action's request body to map each leaf string value to its
     // `payload.<accessor>` expression. The emit's second interpolation pass uses
     // this to substitute literal occurrences (e.g. "Reginald") with their
@@ -5358,6 +5583,12 @@ pascalName = null) {
     // produce nonsense substitutions. Values below the threshold stay literal
     // in the emitted template — fine for short enum-like fields that rarely
     // need to vary at runtime.
+    // Declared payload fields the flow's OWN step instructions correlate to —
+    // the same set {@link emitBrowserFlowTs} derives for its `payload.<field>`
+    // splices, recomputed here (pure function of flowSteps/vocabulary, so it
+    // can never drift from the browser flow's own set) so the facet-splice pass
+    // below can correlate a REST body's facet-packed string leaves against it.
+    const { payloadFieldNames: restPayloadFieldNames, optionalPayloadFieldNames: restOptionalFieldNames, } = computeFlowPayloadFieldNames(flowSteps, vocabulary, process.env);
     const payloadAccessorByValue = new Map();
     if (inputBody !== undefined && inputBody !== null) {
         for (const { value, path } of walkStringLeaves(inputBody)) {
@@ -5612,6 +5843,22 @@ pascalName = null) {
             }
         }
     }
+    // A per-session correlation id (see {@link isVolatileHeaderName}) must never
+    // freeze into a literal — every action re-issues it via the SAME hoisted
+    // `const`, mirroring `threadedTxnId` above: one mint, reused across the
+    // whole flow, not a fresh mint per step (a real per-session id, unlike the
+    // per-call volatile body UUIDs {@link applyVolatileFieldSubstitutions}
+    // regenerates). Keyed by lowercased header name so `Correlation-Id` and
+    // `X-Conversation-Id` each get their own hoisted local if a flow carries both.
+    const volatileHeaderVarNames = new Map();
+    for (const { capture } of actions) {
+        for (const headerName of Object.keys(capture.requestHeaders)) {
+            const lower = headerName.toLowerCase();
+            if (!isVolatileHeaderName(lower) || volatileHeaderVarNames.has(lower))
+                continue;
+            volatileHeaderVarNames.set(lower, `${headerNameToPayloadFieldName(headerName).replace(/^./, (c) => c.toLowerCase())}Value`);
+        }
+    }
     // Pass 1: render every step's emitted strings; collect referenced var names.
     const rendered = [];
     for (let i = 0; i < actions.length; i++) {
@@ -5653,6 +5900,18 @@ pascalName = null) {
                 return null;
             }
         })();
+        // Facet splice — a top-level string leaf packing `key:value` facet
+        // segments (e.g. `filters: "category:widgets|priceRange:10~50"`) gets its
+        // correlated segments spliced with `payload.<field>` here, BEFORE any
+        // other pass can freeze the whole string as one opaque `payload.filters`
+        // accessor (see applyPayloadKeyValueSubstitutions) or swallow it as an
+        // unparameterized structured value. Mirrors renderGqlVariablesExpr's own
+        // facet-splice branch for GraphQL variables — same correlation function,
+        // same declared field set, just applied to REST body text instead of a
+        // variables object literal.
+        const rawBodyWithFacetSplices = parsedBody !== null
+            ? applyFacetSplicePayloadSubstitutions(rawBodyWithFormSubs, parsedBody, restPayloadFieldNames, restOptionalFieldNames)
+            : rawBodyWithFormSubs;
         // Mechanism B — parameterize whole nested caller structures
         // (experienceData/educationData history, opaque eventData) BEFORE value
         // substitution reaches inside them: swallowing the entire array/object first
@@ -5663,7 +5922,7 @@ pascalName = null) {
         // dependent-drill-down join field (e.g. a bulk `{"tokens":[...]}` lookup)
         // must stay reachable for state threading, not get frozen as caller data.
         const rawBodyWithStructuredSubs = parsedBody !== null
-            ? applyStructuredValuePayloadSubstitutions(rawBodyWithFormSubs, parsedBody, outStructuredKeys, new Set([
+            ? applyStructuredValuePayloadSubstitutions(rawBodyWithFacetSplices, parsedBody, outStructuredKeys, new Set([
                 ...deriveStateVarByValue(prior, cap).keys(),
                 ...(joinFieldValuesByStep.get(i) ?? []),
             ]))
@@ -5726,6 +5985,24 @@ pascalName = null) {
         const perCallHeaders = {};
         for (const [k, v] of Object.entries(cap.requestHeaders)) {
             const lower = k.toLowerCase();
+            // A captured `Cookie` header is a session jar, not real request state —
+            // the only sanctioned path for a cookie value to reach a real request
+            // is `collectHeaderBindings`'s `bind` mechanism, driven by an actual
+            // Set-Cookie response. Never emit this header from the capture, even
+            // partially: any splice-and-keep logic here reintroduces a frozen
+            // recon-session literal at finer grain.
+            if (lower === "cookie") {
+                continue;
+            }
+            // A correlation/conversation-id-shaped header is never the captured
+            // literal, threaded state, or an interpolation target — it's re-issued
+            // per call from the flow-wide hoisted mint (see volatileHeaderVarNames
+            // above), regardless of what interpolateStateValues would otherwise do.
+            const volatileVarName = volatileHeaderVarNames.get(lower);
+            if (volatileVarName !== undefined) {
+                perCallHeaders[k] = `\${${volatileVarName}}`;
+                continue;
+            }
             const interpolated = interpolateStateValues(v, prior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
             // Authorization/Api-Token and a structurally-detected join-carrying
             // header are always emitted per-call (even when interpolation finds
@@ -5825,6 +6102,15 @@ pascalName = null) {
         lines.push(`    const txnId = crypto.randomUUID();`);
         lines.push("");
     }
+    // Mint each correlation/conversation-id-shaped header ONCE, same rationale
+    // as txnId above — a frozen capture value would replay one recon session's
+    // id across every real invocation. Emitted only when actually referenced.
+    for (const varName of new Set(volatileHeaderVarNames.values())) {
+        if (!referencedNames.has(varName))
+            continue;
+        lines.push(`    const ${varName} = crypto.randomUUID();`);
+        lines.push("");
+    }
     // Surface any captured literal that no pass could bind, so a reviewer knows
     // exactly which slots still carry recon data. Comment only — never blocks emit.
     if (unboundLiteralKeys.size > 0) {
@@ -6273,9 +6559,24 @@ pascalName = null) {
             // Extract just the per-call header overrides (API-Token etc.) from the
             // rendered headers expression to merge with BASE_HEADERS.
             const perCallHeaderEntries = [];
+            const multipartPrior = actions.slice(0, i);
             for (const [k, v] of Object.entries(cap.requestHeaders)) {
                 const lower = k.toLowerCase();
-                const interpolated = interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
+                // Mirrors the non-multipart per-call header builder above: never
+                // emit a captured `Cookie` header, even partially. The only
+                // sanctioned path for a cookie to reach a real request is
+                // `collectHeaderBindings`'s `bind` mechanism.
+                if (lower === "cookie") {
+                    continue;
+                }
+                // Mirrors the non-multipart per-call header builder above: re-issue
+                // from the flow-wide hoisted mint instead of the captured literal.
+                const volatileVarName = volatileHeaderVarNames.get(lower);
+                if (volatileVarName !== undefined) {
+                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`\${${volatileVarName}}\``);
+                    continue;
+                }
+                const interpolated = interpolateStateValues(v, multipartPrior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
                 // Mirrors the non-multipart per-call header builder above: any
                 // header name (not just Authorization/Api-Token) that interpolation
                 // recognizes as a prior step's produced state var must thread
@@ -8748,31 +9049,30 @@ primaryIdentityAnchor = null) {
             specPlan,
         ];
     }
-    // Keyed by the (primaryStepIndex, primaryArrayPath) pair, not
-    // primaryStepIndex alone — a structural plan only ever consumed ITS OWN
-    // array on that step, not the whole step. A spec whose resultsPath names
-    // a second, structurally-undetected array on that exact same primary step
-    // has already been proven independent by the samePrimaryPlan lookup above
-    // (its primaryArrayPath differs from every structural plan's), so keying
-    // solely on the step index would wrongly treat it as already consumed and
-    // silently drop it. consumedIndices tracks only the steps a plan folds
-    // FROM (each target's drillStepIndex), not its whole replay chain — a
-    // target's chain threads through steps it depends on to reach per-item
-    // data, but only its drillStepIndex is the call it actually folds from,
-    // so sweeping the whole chain would falsely claim steps the spec never
-    // contends for.
-    const consumedIndices = new Set();
+    // Keyed by the (primaryStepIndex, primaryArrayPath) pair, not raw step
+    // indices: that pair is the only thing that identifies whether the spec
+    // describes a primary a structural plan ALREADY owns. A structural
+    // target's own `drillStepIndex` (or any index in its replay chain)
+    // coinciding with a step the spec's own resolution happens to touch is
+    // not, on its own, evidence of a real conflict — an unrelated,
+    // independent primary/drill pair can legitimately enter through (or
+    // replay) the exact same underlying capture the spec's chain does (e.g.
+    // a shared session/auth bootstrap call reused by two unrelated
+    // features), and both targets replaying it per their own items is
+    // exactly what {@link resolveSpecMatchedPrimaryItemIndexAlongChain}'s
+    // multi-hop resolution expects — see the shared-bootstrap-hop-noise
+    // regression test. Excluding on raw index overlap (as an earlier version
+    // of this check did, for BOTH the spec's `drillStepIndex` and its whole
+    // `chain`) silently dropped a real, resolvable declared join whenever
+    // some unrelated noisy structural plan merely touched the same index by
+    // coincidence, which is exactly the "declared fold rejected" failure
+    // mode this function exists to prevent.
     const consumedPrimarySteps = new Set();
     for (const plan of structuralPlansWithPerOccurrenceOverrides) {
         const planPrimaryEndpointKey = endpointKey(actions[plan.primaryStepIndex].capture.url);
         consumedPrimarySteps.add(`${planPrimaryEndpointKey}:${JSON.stringify(plan.primaryArrayPath)}`);
-        for (const target of plan.targets) {
-            consumedIndices.add(target.drillStepIndex);
-        }
     }
-    const specConsumesOnlyItsOwnIndices = !consumedIndices.has(specPlan.primaryStepIndex) &&
-        !consumedPrimarySteps.has(`${specPrimaryEndpointKey}:${JSON.stringify(specPlan.primaryArrayPath)}`) &&
-        specPlan.targets.every((target) => target.chain.every((chainIndex) => !consumedIndices.has(chainIndex)));
+    const specConsumesOnlyItsOwnIndices = !consumedPrimarySteps.has(`${specPrimaryEndpointKey}:${JSON.stringify(specPlan.primaryArrayPath)}`);
     if (specConsumesOnlyItsOwnIndices)
         return [...structuralPlansWithPerOccurrenceOverrides, specPlan];
     // The spec's primary endpoint/array is already consumed by a structural
@@ -9420,6 +9720,11 @@ function buildContractChecklist(opts) {
 function emitContractTs(opts) {
     const { siteId, displayName, pascal, baseUrl, baseHeaders, minTime, safeRps, hasRateLimitProbeData = false, responseBody, responseBodySamples = [responseBody], gql, gqlQuery, endpointPath, gqlOperationName, gqlVariables, allCaptures = [], auxFiles, multiStepBody, omitExecuteHttp = false, isSubmissionFlow = false, inputBody, hasMultipartStep = false, actionSteps = [], foldReturnSpec = null, discoveredFormFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, discoveredStructuredKeys, valueConstraints = value_constraints_1.EMPTY_VALUE_CONSTRAINTS, payloadFieldNames, optionalPayloadFieldNames = new Set(), headerBindings = [], unpopulatedDeclaredVariables = [], fallbackGateSpec = {}, } = opts;
     const { browserFallbackGate, httpTimeoutMs } = fallbackGateSpec;
+    /** Single source of truth for every GraphQL-emission decision below
+     * (clientImport, gqlCacheBlock, queryConst, and both executeHttpBody
+     * fetch-call sites) — `gql` alone can be true with a null `gqlQuery`,
+     * which would emit a `${PASCAL}_QUERY` reference with no declaration. */
+    const isGqlEmission = gql && gqlQuery !== null;
     /** Rendered `meta.browserFallbackGate` literal: `false` verbatim, a
      * list-derived arrow-function predicate matching against `error.name`, or
      * "" (omitted) when the flow declared no gate — preserving byte-identical
@@ -9858,8 +10163,17 @@ function emitContractTs(opts) {
         : "";
     // Emit identifier-shaped keys unquoted so Biome's formatter doesn't rewrite
     // the generated file on first lint:fix.
+    //
+    // A header value shaped like a UUID (e.g. a per-session correlation/
+    // conversation id captured during recon) is minted fresh per call rather
+    // than frozen as the recon capture's literal — the same volatility
+    // convention applyVolatileFieldSubstitutions already applies to UUID body
+    // leaves. The `${…}` fragment is assembled by concatenation, not a literal
+    // template-curly, so Biome's noTemplateCurlyInString doesn't flag THIS
+    // file's own source.
+    const headersUuidGen = `$${"{"}crypto.randomUUID()${"}"}`;
     const headersLiteral = Object.entries(baseHeaders)
-        .map(([k, v]) => `  ${isValidJsIdentifier(k) ? k : JSON.stringify(k)}: ${JSON.stringify(v)}`)
+        .map(([k, v]) => `  ${isValidJsIdentifier(k) ? k : JSON.stringify(k)}: ${UUID_REGEX.test(v) ? `\`${headersUuidGen}\`` : JSON.stringify(v)}`)
         .join(",\n");
     const fixtureImport = auxFiles.length > 0 ? `// import { loadFixture } from "${ENGINE_PKG}/scraper/fixtures";\n` : "";
     // Browser-flow-only plugins have no direct-HTTP hot path, so none of the
@@ -9868,15 +10182,15 @@ function emitContractTs(opts) {
     // `noUnusedVariables`.
     const clientImport = omitExecuteHttp
         ? ""
-        : gql
+        : isGqlEmission
             ? `import { createGraphqlClient } from "${ENGINE_PKG}/scraper/graphql-client";${needsFoldHttpClient ? `\nimport { createHttpClient } from "${ENGINE_PKG}/scraper/http-client";` : ""}`
             : `import { createHttpClient } from "${ENGINE_PKG}/scraper/http-client";`;
-    const queryConst = !omitExecuteHttp && gql && gqlQuery
+    const queryConst = !omitExecuteHttp && isGqlEmission
         ? `\n// Lifted verbatim from recon capture. The adjacent response schema is drift-tolerant by construction (dropped __typename, .loose() objects), so this query text is not hand-trimmed.\nconst ${pascal.toUpperCase()}_QUERY = \`${gqlQuery.trim()}\`;\n`
         : "";
     const gqlCacheBlock = omitExecuteHttp
         ? ""
-        : gql
+        : isGqlEmission
             ? `
 type GqlFn = (operationName: string, query: string, variables: Record<string, unknown>) => Promise<${pascal}Response>;
 
@@ -10225,7 +10539,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                 signal: paginationSignal,
                 foldMergeLines: paginatedFoldMergeLines,
                 valueConstraints,
-                fetchCall: gql
+                fetchCall: isGqlEmission
                     ? {
                         kind: "gql",
                         gqlOperationNameExpr,
@@ -10233,7 +10547,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                     }
                     : { kind: "rest", endpointPath },
             })
-            : gql
+            : isGqlEmission
                 ? `    const data = await getGql(context.baseUrl)(${gqlOperationNameExpr}, ${pascal.toUpperCase()}_QUERY, ${gqlVariablesExpr});
 ${dataFoldMergeBlock}    return { data };`
                 : `    const data = await httpClient(\`\${context.baseUrl}${endpointPath}\`, {
@@ -10627,11 +10941,19 @@ function emitConfigManifest(opts) {
  * every `payload.<field>` the flow references also appears in the contract's
  * payload schema (both are driven by this same set).
  */
-function emitBrowserFlowTs(opts) {
-    const { siteId, pascal, flowSteps, isSubmissionFlow, hasMultipartStep = false, vocabulary, frameSelector, env = process.env, } = opts;
+/**
+ * Resolves the payload field (or composite persona field pair) each flow
+ * step's instruction correlates to — the same per-step correlation
+ * {@link emitBrowserFlowTs}'s step-literal pass performs to decide its own
+ * `payload.<field>` splices, factored out to a pure function of
+ * `flowSteps`/`vocabulary` so {@link emitMultiStepExecuteHttp}'s REST
+ * facet-splice pass can correlate against the exact same declared field set
+ * instead of re-deriving a second, potentially-drifting one.
+ */
+function computeFlowPayloadFieldNames(flowSteps, vocabulary, env) {
     const payloadFieldNames = new Set();
-    // Widest wins, mirroring the request-surface precedent above: a field is
-    // only optional if EVERY step that registers it does so as optional.
+    // Widest wins: a field is only optional if EVERY step that registers it
+    // does so as optional.
     const optionalPayloadFieldNames = new Set();
     const requiredPayloadFieldNames = new Set();
     const registerFieldOptionality = (field, optional) => {
@@ -10642,6 +10964,39 @@ function emitBrowserFlowTs(opts) {
             optionalPayloadFieldNames.delete(field);
         }
     };
+    const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary ?? vocabulary_1.EMPTY_VOCABULARY, env);
+    for (const step of flowSteps) {
+        const isObj = typeof step !== "string";
+        const instruction = isObj ? step.step : step;
+        // navigateTo/emailStep/password-token steps bypass field resolution
+        // entirely — see emitBrowserFlowTs's stepLiterals pass for why.
+        if (isObj && step.navigateTo !== undefined)
+            continue;
+        if (isObj && step.emailStep === true)
+            continue;
+        if (instruction.includes(RECON_PASSWORD_TOKEN))
+            continue;
+        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary, knownFieldValues);
+        const composite = field === null && !(isObj && step.payloadFieldNone)
+            ? resolveCompositePersonaFields(instruction, knownFieldValues)
+            : null;
+        const optional = isObj ? step.optional === true : false;
+        if (field !== null) {
+            payloadFieldNames.add(field);
+            registerFieldOptionality(field, optional);
+        }
+        if (composite !== null) {
+            payloadFieldNames.add(composite.fieldA);
+            payloadFieldNames.add(composite.fieldB);
+            registerFieldOptionality(composite.fieldA, optional);
+            registerFieldOptionality(composite.fieldB, optional);
+        }
+    }
+    return { payloadFieldNames, optionalPayloadFieldNames };
+}
+function emitBrowserFlowTs(opts) {
+    const { siteId, pascal, flowSteps, isSubmissionFlow, hasMultipartStep = false, vocabulary, frameSelector, env = process.env, } = opts;
+    const { payloadFieldNames, optionalPayloadFieldNames } = computeFlowPayloadFieldNames(flowSteps, vocabulary, env);
     const hasUploadStep = flowSteps.some((s) => typeof s !== "string" && s.upload === true);
     const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary ?? vocabulary_1.EMPTY_VOCABULARY, env);
     let usesThrowawayPassword = false;
@@ -10690,16 +11045,6 @@ function emitBrowserFlowTs(opts) {
             ? resolveCompositePersonaFields(instruction, knownFieldValues)
             : null;
         const optional = isObj ? step.optional === true : false;
-        if (field !== null) {
-            payloadFieldNames.add(field);
-            registerFieldOptionality(field, optional);
-        }
-        if (composite !== null) {
-            payloadFieldNames.add(composite.fieldA);
-            payloadFieldNames.add(composite.fieldB);
-            registerFieldOptionality(composite.fieldA, optional);
-            registerFieldOptionality(composite.fieldB, optional);
-        }
         const instructionExpr = composite !== null
             ? buildCompositeStepInstructionExpr(instruction, composite.fieldA, composite.fieldB)
             : buildStepInstructionExpr(instruction, field);
@@ -11294,7 +11639,7 @@ async function main() {
         const minTime = deriveMinTime(rateLimits);
         const hasRateLimitProbeData = rateLimits.some((f) => f.safeRps !== null);
         const safeRps = rateLimits.find((f) => f.safeRps !== null)?.safeRps ?? Math.floor(1000 / minTime);
-        const gql = isGraphQL(activeCaptures);
+        const gql = isGraphQL(activeCaptures, ownBackendHostnames, fallbackDomain);
         // Hoisted so both the primary-operation gate below and rawActionCaptures
         // (further down) read the same computed sequence instead of calling the
         // extractor twice. Computed unfiltered (submitPatterns: null) — a
@@ -11372,9 +11717,25 @@ async function main() {
         // keeps that whole chain; the gap between this and the unfiltered
         // sequence is logged below for visibility, but the declared pattern is
         // never overridden by the richer unfiltered sequence.
+        //
+        // Truncated against a pool RE-EXTRACTED with the declared pattern passed
+        // through (not against unfilteredHeuristicActionCaptures, which is built
+        // with submitPatterns forced to null purely to get an unbiased baseline
+        // for the disagreement check below). extractActionSequence's own
+        // noise/structural-isolation passes have no visibility into the declared
+        // pattern when it's withheld, so on an archive noisy enough to make a
+        // genuine submission capture look structurally isolated, that capture
+        // can be dropped before truncation ever sees it — a real match then
+        // reads as "0 captures" even though the archive contains plenty. Passing
+        // submitPatterns through lets extractActionSequence's own submit-anchor
+        // narrowing (REST) / per-capture submit match (GraphQL) keep the
+        // genuine captures amid that noise, so truncation has them to find.
+        const patternedExtractedActionCaptures = gql
+            ? dedupRedundantSameOperationCaptures(extractGraphQLActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain), primaryGraphQLOperation)
+            : collapseRedundantSameEndpointCaptures(collapseRedundantPatches(extractActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain, false)));
         const patternedHeuristicActionCaptures = submitPatterns.endpoint === null && submitPatterns.body === null
             ? unfilteredHeuristicActionCaptures
-            : truncateActionSequenceAtSubmitPattern(unfilteredHeuristicActionCaptures, submitPatterns, foldReturnSpec);
+            : truncateActionSequenceAtSubmitPattern(patternedExtractedActionCaptures, submitPatterns, foldReturnSpec);
         const patternUndercounts = patternedHeuristicActionCaptures.length < unfilteredHeuristicActionCaptures.length;
         if (patternUndercounts && requireSubmitEndpointMatch) {
             // Distinct wording from the non-required case below: this pattern is never
@@ -11582,7 +11943,7 @@ async function main() {
         const multiStepBody = browserFlowOnly
             ? undefined
             : isSubmissionFlow
-                ? emitMultiStepExecuteHttp(actionSteps, inputBody, errorSignals, fieldNameMap, discoveredPayloadAccessorFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema, personaBindings, entryUrlParams, shieldedUuids, selectResolutions, discoveredStructuredKeys, rawCodeFields, foldReturnSpec, pascal)
+                ? emitMultiStepExecuteHttp(actionSteps, inputBody, errorSignals, fieldNameMap, discoveredPayloadAccessorFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema, personaBindings, entryUrlParams, shieldedUuids, selectResolutions, discoveredStructuredKeys, rawCodeFields, foldReturnSpec, pascal, flowSteps, vocabulary)
                 : undefined;
         // Explicit merge — every field emitMultiStepExecuteHttp registered as a
         // `payload.<field>` accessor (BaseUrl, persona, entryUrlParams, tenant-